ImageMagick · ImageMagick
CVE-2016-3714
ImageMagick Improper Input Validation Vulnerability
What it is
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
CISA: ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: September 30, 2024
- Added to the CISA list
- September 9, 2024
- Published
- May 5, 2016
- Severity
- High 8.4 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 97% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-20
- More details
- NVD · CVE.org · CISA
All references (20)
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00041.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html
- http://www.ubuntu.com/usn/USN-2990-1
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html
- http://www.debian.org/security/2016/dsa-3746
- https://security.gentoo.org/glsa/201611-21
- https://access.redhat.com/security/vulnerabilities/2296071
- http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog
- http://www.securitytracker.com/id/1035742
- https://imagetragick.com/
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
- http://www.openwall.com/lists/oss-security/2016/05/03/13
- http://www.securityfocus.com/archive/1/538378/100/0/threaded
- https://www.exploit-db.com/exploits/39767/
- http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.openwall.com/lists/oss-security/2016/05/03/18
More exploited flaws from ImageMagick
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Arbitrary File Deletion | ImageMagick | Medium 5.5 | 75% |
| Nov 3, 2021 | Server-Side Request Forgery (SSRF) | ImageMagick | Medium 5.5 | 76% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.